Custom field in checkout with proper server-side validation

Question

I've been trying to get this to work for a while now, and i've found out it's pretty easy to bypass now.

I've added my custom validation in js/prototype/validation.js and in the checkout step. However, when you inspect the element (with ex. Chrome) and remove the validate-morgen and required-entry classes, the input field will validate as true, which it isn't. Is there another way to make this that this field is being validated properly on the server-side?

Validation.js:

['validate-morgen', 'Voer een juiste morgen-bezorgen code in. Heeft u geen code? Gelieve telefonisch contact op te nemen.', function(v) {
 if (v != "gmos") {
 return false;
 } else {
 return true;
 }
 }]

HTML input field:

<input id="morgen-bezorg-code" class="input-text validate-morgen"
 placeholder="Morgen-bezorgen code" />

Answer 1

I assume that you submit the form to a controller action.
You can get the values submitted with $this->getRequest()->getPost().
You can check if your field is filled in.
If it's not, redirect back with a message saying the field is mandatory.